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■ Abstract 

We study the potential of general quantum operations, Trace-Preserving Completely- 
Positive Maps (TPCPs), as encoding and decoding mechanisms in quantum authentication 
t— I ' protocols. The study shows that these general operations do not offer significant advantage 

over unitary encodings. We also propose a practical authentication protocol based on the 
use of two successive unitary encodings. 

o : 

q ; 1 Introduction 

m ■ 

The past two decades have seen an enormous increase in the development and use of networked 
and distributed systems, providing increased functionality to the user and a more efficient use 

Oh! 

of resources. To benefit from such systems, users cooperate by exchanging information over 
communication channels. In many occasions, this information requires to be protected from 
unauthorised users. The whole discipline of Cryptography addresses this issue. 

Security in communication channels has been greatly improved by recent advances in the 
field of Quantum Information Processing (QIP). The most notable example is Quantum Key 
. ^ ' Distribution (QKD) [21131, for which the phase of experimental demonstration inside 0j and 

^ ■ outside jSlin] research laboratories has lead to the development of commercial products nowadays. 

One aspect of QKD that is sometimes underestimated is the dependence of its security on the 
existence of an authenticated classical channel between the users. Basically, some technique 
must be designed to allow one party (the verifier) to gain assurances that the identity of another 
(the claimant) is as declared, thereby preventing impersonation. The most common technique 
is by the verifier checking the correctness of a message which demonstrates that the claimant is 
in possession of a secret associated by design with the genuine party. Such a technique is called 
a Message Authentication Code (MAC), first proposed by Gilbert and co-workers in (Zj. More 
formally, an authentication code involves a set of source messages, S, a set of authentication 
tags, T, a set K, of secret keys, and a set of rules such that each k £ K, defines a mapping 
to obtain the tag from the source message: u& '■ S —* T '. According to this, an authenticated 
message, consisting of a source state and its tag, (s,t), with t = u&(s), can be verified only by the 
intended recipient, with whom a key has been shared previously. There are many MACs with 
different degrees of security. MACs intended to provide unconditional security were first studied 
by Wegman and Carter (Sj combining one-time pads with hash functions. This approach was 
later pursued by Brassard |H] trading unconditional security for short keys, and further refined 
by Krawczyk |10| . 

The use of quantum resources to obtain more efficient classical-message authentication 
schemes is still an open issue. In |llj the authors showed that quantum information techniques 
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can be used to authenticate a binary classical message with a key of length shorter than the one 
required by classical schemes. However, it is not clear yet whether that would be the case with 
longer messages. Leung ^2] has recognised the potential relevance of authenticating quantum 
information in future quantum communication systems, and Barnum and coworkers ^Hj have 
proposed a secret-key quantum authentication protocol that uses stabiliser purity testing codes. 
Surprisingly, they showed that any protocol that guarantees secure authenticity must encrypt the 
quantum plain-text almost perfectly. This fact contrasts with classical MACs, where encryption 
of the plain-text is not necessary for unconditional security. More recently, Gea-Banacloche ^1] 
has approached data authentication from a steganographic perspective, making use of quantum 
correcting code techniques. 

In this paper we extend and further develop previous work |15[ I16j on the authentication 
of quantum information with unitary coding sets. Our purpose is two- fold. First, in Section [2J 
we investigate whether the use of reversible TPCP maps in the encoding and decoding stages 
of our protocol improves its robustness against several common attacks; we restrict ourselves 
to the simple case of a single qubit since our goal is to compare our results with those of |15j . 
Second, in Section |3] we study the authentication of arbitrarily complex quantum messages. 
Now, instead of using a TPCP map, we propose a sequence of two unitary encodings. We show 
that proceeding in such a way improves the security of the authentication protocol. Finally, in 
Section |3J we present our main conclusions. 

2 Authentication with general quantum operations 

In the general quantum authentication setting Alice sends a quantum message to Bob with 
the goal of making Bob confident about the authenticity of such message. If we consider that 
both participants share a quantum secret key (for example, a set of EPR pairs), and they have 
access to an authenticated classical channel, then the solution is quite simple: Alice can just use 
quantum teleportation to send the quantum plain-text. However, here we shall assume that 
no classical authenticated channel is available, and that the previously shared keys are standard 
classical bits (the nature of this assumption is practical, given the technological difficulties 
that still exist to the the manipulation of qubits). Our main goal is to extend the standard 
MAC technique to the quantum realm. For the sake of simplicity, let us assume that the source 
quantum message is a qubit described by the density operator p$ belonging to a two-dimensional 
source message space S. Following the standard procedure, Alice appends a tag (a public-known 
quantum state) to the message in such a way that the recipient, Bob, may verify the tag and 
so convince himself about the identity of the message originator. The tag is also given by a 
density operator pr, belonging to a tag space T. Therefore, the quantum tagged-message is 
described by the operator pe = ps® PT that acts on the state space £ = S (&T . To validate the 
message, Alice and Bob also openly agree on a particular splitting of the tag space T into valid 
and invalid tags. The space T can then be seen as the direct sum of two subspaces, T = V © V , 
where V is the subspace of valid tags and V 1 " is the subspace of the invalid ones. The splitting 
of T leads to the direct sum £ = C © C -1 , where C = S © V (dim(C) = C) and C 1 - = S © V 1 - 
(dim(C ) = D) are, respectively, the subspaces of valid and invalid tagged messages. A message 
originally prepared by Alice will thus belong to C. 

We shall assume that Alice and Bob share a minimum-size key of just one bit, k. Depending 
on its value, Alice performs an encoding rule on the tagged message: She will apply an I 
operation in one case (Alice does nothing to the tagged message) , and a reversible (to guarantee 
perfect deterministic decoding) TPCP map |18l I19j in the other. It is worth noting that this 
is completely equivalent, in security terms, to the use of two TPCP maps. The action of the 
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TPCP map on p £ can be written as 

E(p £ ) = ^2d j U j p e u}, (1) 
j 

where the Uj are unitary operators, the dj are real and positive, and the following restrictions 
apply: 

E^ = L ( 2 ) 

j 

PiUtUjPi = S jk , (3) 

where Pi is the projector onto C. Condition © together with the unitarity of the Uj operators 
guarantees that the operation will be trace-preserving. Condition © assures the reversibility 
of the TPCP map if the input state p £ belongs to the subspace of valid messages C. After the 
encoding, Alice will send to Bob, depending on the value of the key, either p £ or E(p £ ). In both 
cases we will call the message sent by Alice p £ (k). On the reception side, Bob will decode the 
message sent by Alice according to the value of the the key he also holds: If Alice sent pg, Bob 
will not do anything to the message. Otherwise, he will apply the decoding operation |181 119j 

R(E(p e )) = £ PiUjEipg^jPi + P N E(p £ )P N , (4) 

j 

where P N = I - J2j UjPiU]. Substituting (© in © we have that R{E{p £ )) = PiPsPi = pe, if 
p £ belongs to C, recovering in this way any valid message sent by Alice. Next Bob has to verify 
tag appended to the message. If it belongs to V, he will accept the message, otherwise he will 
discard it suspecting a manipulation in the channel. 

In the following subsections we shall analyse the security of this scheme to several attacks. 
In the forgery attack we shall regard Eve capable of intercepting the state travelling from Alice 
to Bob, discard it, and forge a new tagged message. In the measurement attack, Eve measures 
the message in the channel trying to discover the key used. Finally, in the unitary attack, we 
shall assume that Eve can modify the state in the channel by means of a unitary operation. For 
simplicity we shall initially consider a two-dimensional tag space T. 



2.1 Forgery attack 

Suppose Eve prepares a forged tagged message pf and sends it to Bob trying to impersonate 
Alice. When Bob receives this message, depending on the value of the key, he will either apply 
to the message the decoding operation © or he will do nothing. After this decoding, Bob 
will reject the message if the measurement on the tag space T shows that it belongs to V . 
Therefore, the probability Pf that Eve deceives Bob is 

P f = hr £ [P l p§ + P l R(p§)]. (5) 

This quantity depends both on Eve's strategy and on the reverse of the TPCP map actually 
chosen by Alice and Bob. She will succeed with probability one if 

Pf G C, (6) 

and 
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R(Pe) = E p i U }P£ U i p i + PnPePn e C. (7) 



To better study these conditions we will make use of the following decomposition. Defining 
the orthogonal projection operators Pi and P D as the ones that, respectively, project a state 
from £ onto C or onto C -1- , an arbitrary operator Ag can be written as 

Ag = An + Ai ~\~ A Q i + A 00 , (8) 

where A,^ = PjA^P^, with j, fc = i, o. If the decomposition (JSJ) is used in operator expressions 
of the form \£ = AgpgAg, the corresponding 'i-o' operators are related by the matrix equation 




(9) 



I Xii Xio I _ I An Ai \ I Pit Pio 
V Xoi Xoo J y A Q i A 00 J y Poi Poo 

where = P k A\Pj. 

Using this decomposition, condition © requires the following matrix form for pj?: 

In condition ([7Jl. the summation in the right side is always in C due to the action of Pi. We are 
left with the second term. Writing Uj = U~ + U\ + U 3 oi + J7^ , where U 3 kl = PjJJjPi, we have: 

With this notation the second term of (J7J vanishes when 

# H = 0, (12) 

and 

(G« - i>f # = 0, (13) 

where -ff = X)j U^U 3 }, and Gj, = X)j U^U^. In order to further analyse these equations let us 
first study the structure of the Uj operators. Since the tag space is two-dimensional, each Uj 
will be a 4 x 4 square matrix. Given their unitarity, their rows and columns will be orthonormal 
vectors. We may write two of these operators in column-vector form as 



Ui = (ui\u 2 \u 3 \u 4 ), (14) 
U 2 = (vi\v 2 \v 3 \v4,), (15) 

where the sets {v,j} and {vj} are two basis of a four-dimensional vectorial space. The reversibility 
condition, Eq. ©, imposes that the first two vectors of each set must also be orthogonal, so 
the set {ui,U2,vi,v 2 } will also be a base. This means that we can only have two operators 
composing the TPCP map. A third one will necessarily have its first two columns orthogonal to 
the first two columns of the other two operators, which is impossible. Therefore, our encoding 
operation can only be composed of up to dim(£)/dim(C) (2 in our case) unitary operators. 
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With two unitary operators forming the encoding operation and a two-dimensional tag space, 
we can calculate H = Y^jU^U^. Using the fact that {u\, U2, «i, v%\ is an orthonormal base, 

we obtain H = 0, and analogously Gu = J2j ^ii^u = I- So Eve will always fulfil conditions 
(|12j) and l|13j) . This will always happen if we choose the maximum number of unitary operators 
allowed by the dimensions of £ and C. One possibility to overcome this would be to choose only 
one unitary operator, but then the encoding operation would be unitary, and it has been shown 
111 [T5] that with a one-bit key a unitary encoding is not secure. Another possibility would be to 
use a larger tag space T that will increment dim(£) without increasing dim(C) (V will remain as 
a one-dimensional subspace of T). This will allow us to use more unitary operators to form the 
non-unitary TPCP map without choosing the maximum of operators allowed by the dimensions 
of £ and C. Specifically, if we use two qubits for the tag, we have a four-dimensional tag space T. 
Imposing that the valid tag subspace V is one-dimensional, we have that dim(£) = 8, dim(C) = 2, 
and dim(£ )/dim(C) = 4. We can thus choose up to three unitary operators to construct the 
TPCP map. With two or three operators it is easy for Alice and Bob to make impossible for 
Eve to satisfy (|12|) and H13|) . This follows from the fact that to fulfil (|12j) Eve has to choose pg 
with support on the kernel of W. But since since dim(C) < dim(C' L ) and W acts from C on 
C , Alice and Bob can always choose Uj such that the kernel of W is empty. Therefore, there is 
no pg fulfilling (|12|) . Therefore, in the following we will shall consider a tag space of dimension 
greater than two. 



2.2 Measurement attack 

Now Eve tries to measure the message sent by Alice to discover the key used and replace the 
message with one of her own. Since Eve does not know which message, ps, was sent, the 
only way she has to discern between the two possible values of the key is measuring the tag. 
Therefore, to make this strategy successful, Eve needs the tag of any message encoded with E(-) 
to belong to V 1 - so as to distinguish it from the tag of a message encoded with / that belongs 
to V. Specifically, Eve needs that 



^ Jl ui ul \ I uil mi 



This condition requires that 




J2 d MPsU£ = 0, V P5 , (17) 



and 



E^«f = 0. V^. (18) 

3 

Since the dj are positive, each term in (fT7|) is positive and Eve needs that 

uIpsu£ = o, V Ps ,Vj. (19) 

This is true V/95 iff U~ = 0, Vj, which is easily avoided by design. 
2.3 Unitary attack 

Let us assume now that Eve performs a unitary quantum operation Fg on the encoded tagged 
message in transit between Alice and Bob. This operation changes the state of the encoded 
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message from p s (k) to Fgpg(k)F^. Bob, ignorant about this action, will perform his decoding 
operation on the encoded tagged message received. Since Eve does not know the value of the 
key used, the probability of deceiving Bob will be 



Pu = X -Xxs\PiFe P£ Fl + P i R{F £ E{p £ )Fl)}, (20) 



with 



R{F e E( P£ )Fl) = £ PiUlFe £ djUjpsU^F^UkPi + P N F £ £ djU jP£ u}F^P N . (21) 

k j j 

In other words, for Eve to succeed with P u = 1, she needs that 

F £P£ Fl e C, (22) 



and 



The first condition means that 



R{F £ E{p £ )Fl) e C. (23) 



Ol - 1 oo 

This condition is satisfied if 



F« F io \( p s 0\(Fl 4 \ = / 
F oi F 00 J I Oil pt F t I l00 



(24) 



io oo 



(II) 



Writing (|23*)) as in l|21jl. we see that the first term of l(2*T|) always fulfils ((2*3*)) . Suppose Eve can 
choose the operator i*£ such that it commutes with P/v , then the second term in (|21j) transforms 
to 

FsPNj^djUjPipsPiUjPNFl (26) 
i 

where we have also used the fact that p £ belongs to C, and so p £ = Pip £ Pi. Now using the 
reversibility condition @ it is easy to see that the operator P/vC/jPj is identically zero for all j: 

P N UjPi = (/ - E UkPiUlWjPi = U 3 Pi - UkWlUjPi - UjPiUjUjPt = 0, (27) 

k k^j 

where the second term is zero because of (jHJ), and the other two terms cancel out each other. Thus 
we have shown that, provided Eve can find a unitary operator F £ fulfilling (|25|) and commuting 
with the projector Pjv, she can deceive Bob with probability equal to one. Does such unitary 
operator exist? 

Let us explore the similarity of this problem to the one we faced in |16j (unitary encodings). 
Let Pm be the the projector orthogonal to Pn- 



-m = I-Pn = Y.U 3 P,u}=( G ^ g). (28) 



(29) 
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Since Fg is unitary, condition (|25f) is equivalent to [Fg,Pi\ = 0, and so our problem (Eve finding 
Fg making P u = 1) can be stated in compact form as: 



Note that these equations do not explicitly depend on the index j, that is, on the individual 
form of the encoding operators Uj, but on a global characteristic of the TPCP map (through 
the sum inside Pm)- For this individual dependence to dissappear, and also for Pm to be a 
projector, it is essential the relation between the Uj defined by the reversibility condition. 

From we know that the problem given by Eqs. <fH01)— dHU) has solut ion regardless its 
dimension and the explicit form or rank of the two projectors. In fact, the problem is completely 
equivalent to the one studied there for the case of a unitary encoding with just one bit of key. 
In particular, the family of Fg fulfilling ()3U|) - ()31|) is the same, and so Eve can transform the 
original message as desired. Thus we conclude that, using the more general set of reversible 
TPCP maps for encoding, one bit of key is still not enough to authenticate one qubit quantum 
message. 

3 Double encoding 

In the preceding section we have shown that using more general encodings, such as TPCP 
maps, does not provide any advantage over unitary operations in the authentication of an 
elemental piece of quantum information (a qubit). Therefore, it seems reasonable to undertake 
the authentication of arbitrary quantum information with unitary encodings. In ^H] we did so 
for the case in which Alice and Bob share a classical n-bit key. According to this authentication 
procedure, Alice, depending on the value of the key, performs a unitary encoding rule on the 
tagged message, U(k), selected from the unitary coding set {U(0), • • ■ , U(K — 1)}, where K = 2 n 
and f7(0) = /. We found the necessary conditions that this unitary coding set must satisfy to 
protect against forgery and unitary attacks. Unfortunately, these conditions cannot be fulfilled 
simultaneously, i.e. the encoding operators that minimise Eve's probability of success in a forgery 
attack does not protect at all against the unitary attack. In this section we present a two-stage 
encoding procedure that tries to circumvent such deficiency. The different phases of this new 
protocol are the following: 

1. Tag 1: Alice prepares her message, p$, which belongs to the state space S (dim(<S) = S). 
She now appends to the message a tag described by pr x that belongs to the state space 
T\ (dim(7i) = T\). The space of tagged messages is £\ = S ® T\ , and the tagged message 
will be described by p £l = ps <8> PTj ■ Alice and Bob openly agree on a particular splitting 
of the tag space 7| into the direct sum of two subspaces T\ = Vi © V^~, where Vi is the 
subspace of valid tags, and Vi is the subspace of the invalid ones. This splitting of 7| 
leads to the direct sum £ \ = C\ , where C\ = S <S> V\ is the subspace of valid messages 
(dim(Ci) = C\), and Ci = S (g> Vi is the subspace of the invalid ones (dim(Cj L ) = D\). 

2. Encoding 1 : Alice, depending on the value of a ni-bit key shared with Bob, performs 
an encoding rule on the tagged message. The encoding rule, U±(p), is selected from the 
unitary encoding set {?7i(0), • • • , U^Ki - 1)}, where K x = 2 ni and f7i(0) = /. If the 
tagged message is pg l , the state of the message after this encoding is 



[F E ,Pi\ = 0, 
[Fs,Pm] =0. 



(30) 
(31) 



Pe 1 (p) = U 1 (p) P£l Ul( P ). 



(32) 
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Thus, a tagged message encoded by Alice with U\(p) will necessarily belong to C p , the 
subspace of all the tagged messages transformed by U\{p). The aim of this first encoding 
is to protect against unitary attacks. As it has been shown in |16| . the Ck subspaces, k = 
0, K\ — 1, must be chosen at an intermediate point between zero and total overlapping 
so as to offer the best possible protection against this type of attack. 

3. Tag 2: After this first encoding, Alice appends a second tag pq~ 2 to the already encoded 
and tagged message, obtaining 



The state space of the second tag is T2 and is analogously divided into the subspaces 
of valid and invalid tags T2 = V2 © V;j • The space of the messages tagged twice is 
£ = £± <g) 7~2 = <S © 71 © 72 , and the valid and invalid message subspaces £ = C © C 1 - 
(dim(C) = C, dim(C^) = D). The second tag appended by Alice will thus belong to V2. 
Regardless of the dimension of 72, we shall assume V2 to be one-dimensional, with 1 0)7-2 a 
base of this subspace, and thus pr 2 = |0)(0|r 2 - 

4. Encoding 2: Finally, Alice performs a second encoding on the twice-tagged message de- 
pending on the value of a second key q shared with Bob. The encoding rule, U2 (<?), is 
selected from the unitary coding set {^(O), • • • , XJiiKi — 1)}, with 1/2(0) = I. This second 
encoding is intended to protect the message against forgery attacks without interfering 
with the first encoding. In order to achieve this goal, Alice and Bob choose a number of 
operators K2 — 1 equal to the dimension of the invalid tag subspace V^. Let us consider 
the following base of this subspace: {|l)r 2) |2)r 2 > • • • , 1-^2 — 1)t 2 }- The encoding operators 
{£/2(0), • • • , U 2 {K 2 - 1)} acting on £ can be written as U 2 (k) = Efj=o ^(% © 
with U2(k)ji acting on £\ = S © T\. We shall further impose on the unitary encoding 
operators the condition U2(k)oj = U2(k)jo = 5jk- As we shall explain later, this allows to 
protect the message against forgery without interfering with the first encoding. After this 
second encoding, the expression for the message to be sent through the channel is: 



5. Verification: When Bob receives the message, he performs the matching decoding rule to 
Alice's second encoding, Jj\ (q), and measures the second tag attached. If it belongs to V2, 
he will continue, after tracing out the second tag attached, with the verification procedure: 
He will first decode, with Jj\(p), Alice's first encoding, and then will measure the first tag 
and check whether it belongs to Vi- If this is the case, Bob will regard the message as 
authentic and will recover the original plain-text after tracing out both tags. 

We shall now analyse the effects of Eve's attacks on this protocol. 
3.1 Forgery attack 

In this attack Eve has the power to replace the tagged message in transit between Alice and 
Bob with a forged tagged message of her own, pe- From this message, Bob will perform his first 
decoding obtaining 



pe = P£i(p)®Pt 2 - 



(33) 



ps(q) = U 2 (q)p £l (p) © |0)<0|r 2 E/ 2 T (g)- 



(34) 



Ul{q)p E U 2 {q) 



(35) 
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with q the value of the second key shared with Alice. The probability of Eve being undetected 
is 



1 

K 2 



k 2 -i 

E 

fc=0 



tie 



1 

K 2 



k 2 -i 



P2U 2 (ky PE U 2 (k) =— V tv £ [P 2 (k) PE }, 



k=0 



(36) 



where P 2 = I £l ® |0}(0|r 2 is the projector onto C, and P 2 {k) = U 2 (k)P 2 U2(k) is the projector 
onto C transformed by U 2 (k). But, since we have imposed before that U 2 (k)oj = U 2 (k)jo = 5jk, 
P 2 (k) = I £l (8> \k){k\r 2 i and then Pf = 1/K 2 . Therefore, Alice and Bob can decrease Eve's success 
probability increasing K 2 , protecting in this way the message against forgery. Note also that the 
projectors P 2 {k) are mutually orthogonal. In other words, the effect of the condition imposed 
over the set of operators U 2 (k) is to transform the space of valid messages C into orthogonal, 
disjoint subspaces. In ^H] we showed that this type of unitary set provides optimal protection 
against forgery attacks. 



3.2 Unitary attack 

Let us now assume that Eve performs a unitary quantum operation F £ on the encoded tagged 
message in transit between Alice and Bob. This operation changes the state of the message from 
pe{q) to F £ p £ (q)Fg. Bob, ignorant about this action, will perform his first decoding operation 
on the message received, obtaining as the decoded tagged message 

Ul{q)F £ pe{q)FlU 2 (q). (37) 
Thus, the probability of Eve being unnoticed after this first test is 



1 k 2 -i 1 K 2 -l 

p v = -jr E tr £ [P2Ul(k)F £ p £ (k)Flu 2 (k)\ = — [4 P 2{k)F £ pe(k)\ . (38) 

2 k=0 2 k=0 

Since the subspaces obtained after transforming C with the set U 2 (k) are all orthogonal, disjoint 
subspaces of £, if Eve chooses a unitary operator F £ acting inside each subspace separately 
according to 

K 2 -i 

F £= E F ii®b')0'lr 2 , (39) 

j=0 

with Fjj unitary and acting on then F^P 2 (k)F £ = P 2 (k), and she will always pass Bob's first 
test. The manipulated message that Bob accepts after his first test will be 

p'eM = trr 2 (P2(q)F e U 2 (q)p £l (p) ® \0)(0\ T2 UUq)P £ ) ■ (40) 



After some algebra it can be shown that p £l (p) reduces to F gq p £l (p)F^ q , where p £l {p) is the 
original message tagged for the first time by Alice, and encoded with U\{p). Bob will now 
decode this message with lj\{p), and verify the first tag appended by Alice. Therefore, if Alice 
and Bob choose the unitary encoding set {C/i(0), • • • , U\{K\ — 1)} to offer the best possible 
protection against a unitary attack regardless of its effectiveness against a forgery attack, the 
entire procedure will protect the message simultaneously against both attacks with the best 
protection that a single encoding can give against each attack separately. 



9 



4 Conclusion 

In Section [2] our goal has been to investigate whether the use of TPCP maps in the encoding 
and decoding operations could improve the security of authentication protocols as compared to 
the unitary encoding studied in |15| and In |15| we showed that one bit of key is enough to 
protect one qubit of message against forgery or measurement attacks, but not against unitary 
attacks. One could expect that the extended complexity of a TPCP encoding would protect 
more efficiently against these attacks. However, we have found exactly the opposite to hold: the 
use of a TPCP map does not improve at all the security of the protocol with one bit of key; 
in fact, there is no reason for Alice and Bob to use it, as it needs more resources. This result 
is strongly related to the reversibility condition imposed on the TPCP map. That condition 
requires the TPCP map to act inside the coding subspace, effectively, as a collective unitary 
operator. 

With this idea in mind, in Section |3 we have approached the authentication of arbitrary 
quantum information with a double encoding. We have shown that it offers simultaneous pro- 
tection against unitary and forgery attacks with the best protection that a single encoding can 
give to each attack separately. 

Many open questions related to the quantum authentication schemes analysed deserve further 
investigation. For example, a more practical definition of the probability of failure is required. 
For instance, Eve might, with high probability, transform the original message, but only in a 
way such that the fidelity between the original and the transformed state be still very high. It 
could also be the case that she could strongly transform, without being noticed, messages inside 
a particular subspace of the valid message space, and be noticed if she transforms messages 
outside of it. All these situations would have to be considered by Alice and Bob in any practical 
implementation of the protocol. 
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